Guidance · Situation

The board wants a cyber update

A board or committee paper is due and the last one was a status report.

Why this moment is hard

A board can govern a position against the risk it agreed to carry; it cannot govern a list of activities. The hard part is saying plainly where you stand, including bad news, and asking for a decision the board can actually make.

5 Guidance questions3 pack documentsAbout 2 h of reading in all

This is a reading path, not a checklist. Nothing is ticked off or saved, and you can start at any step.

First, the decisions

Guidance · Board and executive reporting
How do we report cyber to the board as governance rather than a status update?
5 decision points · about 10 min to read
Why here The shape of the report: position, direction, exposure, ask.
Guidance · Board and executive reporting
How do we choose which metrics the board sees?
6 decision points · about 10 min to read
Why here Which few measures belong in front of the board.
Guidance · Board and executive reporting
If the board asks "are we secure?", then how do I answer honestly?
5 decision points · about 10 min to read
Why here The question that will be asked, answered honestly.
Guidance · Board and executive reporting
How do we prepare for the questions the board will actually ask?
4 decision points · about 10 min to read
Why here Prepare for the questions the board will actually ask.
Guidance · Board and executive reporting
How do we turn a budget request into a decision the board can make?
5 decision points · about 10 min to read
Why here If you need money, write it as a decision, not a need.

Then, the documents

Framework / Methodology · P03-A02
Board Reporting Narrative Model
Board Cybersecurity Reporting · about 35 min to read
Why here The narrative structure, from position to ask.
Matrix / Catalogue · P03-A04
Board Metric Selection Catalogue
Board Cybersecurity Reporting · about 30 min to read
Why here Candidate measures, with a view on whether each should reach the board.
Template / Form · P03-A07
Cyber Risk One-Page Board Summary
Board Cybersecurity Reporting · about 5 min to read
Why here The single page for a board that reads one page.

There is no CISO Times tool for this situation yet, so the path ends with the documents.

Reading times are estimates: the words on each question's flow or document's preview at 220 words a minute, rounded up to the next five minutes. A tool shows its own time.